Remote File Creation in World Writeable Directory

event.category:file and host.os.type:linux and event.action:creation and
process.name:(ftp or rsync or scp or sftp or sftp-server or ssh or sshd or vsftpd) and
file.path:((/dev/shm/* or /tmp* or /var/tmp*) and not (/tmp/ansible-tmp-* or /var/tmp/ansible-tmp-*)) and
not user.id:0